{ "meta": { "exportedAt": "2026-09-22T14:31:34.029Z", "formatVersion": 2, "selection": { "q": "coding-agent", "system": "", "harm": "", "context": "", "country": "", "role": "", "relation": "", "evidence": "", "year": "", "response": "", "severity": "", "verification": "", "view": "incidents", "sort": "added" }, "totalIncidents": 1, "coverage": { "cases": 1, "countries": 0, "languages": 1, "unknownLocation": 1, "locationPending": 0, "unknownLanguage": 0, "unknownDate": 0, "lawsuits": 0, "regulatory": 0, "minors": 0, "coreRelations": 1, "contextualRelations": 0, "mixedRelations": 0, "unknownRelations": 0, "relationPending": 0, "relationUnknown": 0 }, "countingNote": "Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.", "affectedCountNote": "Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.", "source": "NOPE Incident Tracker", "url": "https://nope.net/incidents", "license": "CC BY 4.0" }, "incidents": [ { "id": "2026-pocketos-cursor-claude-opus-agent-deleted-production-database-railway", "caseFacts": { "claims": [ { "id": "c1", "status": "corroborated", "evidence": [ { "locator": "'deleted our production database and all volume-level backups in a single API call to Railway, our infrastructure provider,\" he explained.'; 'granted a fully permissioned API token that decided to call a legacy endpoint which didn't have our'", "relation": "supports", "source_id": "s1" }, { "locator": "'a Cursor AI agent accidentally deleted the company's production database and backups, causing disruption for customers.'; 'Jake Cooper, the founder of Railway, confirmed the recovery in a separate post and said that an AI agent had \"vibe deleted\" PocketOS' production database.'", "relation": "supports", "source_id": "s2" } ], "assertion": "On Friday 24 April 2026 a PocketOS-side AI coding agent, using a fully permissioned Railway API token, called a legacy delete endpoint and deleted PocketOS's production database volume on Railway; Railway's founder confirmed that a customer's AI agent had done so.", "causal_attribution": "The founder's account, confirmed as to the agent's deletion by Railway's founder (public post and statements to both outlets); the date is the Friday before The Register's Monday 27 April report, whose author says the founder 'spent the weekend recovering'." }, { "id": "c2", "status": "reported", "evidence": [ { "locator": "'Crane said that it meant PocketOS' customers lost reservations and new customer signups, and that some were unable to find records for customers who turned up to collect their rental vehicles on Saturday.'", "relation": "supports", "source_id": "s2" } ], "assertion": "PocketOS's customers, car-rental companies, lost reservations and new customer sign-ups, and some were unable to find records for customers who turned up to collect rental vehicles on Saturday 25 April 2026.", "causal_attribution": "The founder's account to Business Insider; 'Saturday' is read as 25 April 2026 from The Register's timeline (Friday deletion, weekend recovery, Monday report); no customer has spoken publicly." }, { "id": "c3", "status": "corroborated", "evidence": [ { "locator": "'Cooper told Business Insider that Railway recovered the data 30 minutes after connecting with Crane'; 'He said that the PocketOS situation was a \"rogue customer AI\" that was given permissions that meant it interacted with a \"legacy\" Railway endpoint that didn't have a feature to delay deletions. That endpoint has now been patched, he added.'", "relation": "supports", "source_id": "s2" }, { "locator": "'granted a fully permissioned API token that decided to call a legacy endpoint which didn't have our'; 'We've since patched that endpoint to perform delayed deletes, restored the users data'", "relation": "supports", "source_id": "s1" } ], "assertion": "Railway restored PocketOS's data about 30 minutes after connecting with the founder; Railway's founder described a 'rogue customer AI' granted a fully permissioned API token that called a legacy endpoint lacking delayed-delete logic, which has since been patched.", "causal_attribution": "Railway's founder's statements to each outlet separately." }, { "id": "c4", "status": "reported", "evidence": [ { "locator": "'I violated every principle I was given: I guessed instead of verifying, I ran a destructive action without being asked, I didn't understand what I was doing before doing it'", "relation": "supports", "source_id": "s2" }, { "locator": "'I guessed that deleting a staging volume via the API would be scoped to staging only. I didn't verify.'; 'Yes our responsibility was the unknown exposure to a production API key'", "relation": "supports", "source_id": "s1" } ], "assertion": "Asked to explain itself, the agent wrote that it had guessed instead of verifying, had run a destructive action without being asked and had not understood what it was doing; the founder blamed Cursor's safety marketing and Railway's API design while accepting his own exposure of a production API key.", "causal_attribution": "The agent transcript and the founder's assessments as published by the founder and quoted by both outlets." }, { "id": "c5", "status": "reported", "evidence": [ { "locator": "'It took 9 seconds.'; 'the Cursor agent encountered a credential mismatch in the PocketOS staging environment and decided to fix the problem by deleting a Railway volume'; 'The token had been created for adding and removing custom domains through the Railway CLI but was scoped for any operation, including destructive ones.'; 'Railway stores volume-level backups in the same volume'", "relation": "supports", "source_id": "s1" }, { "locator": "'which was running on Anthropic's Claude Opus model, making a single nine-second API call to the company's cloud infrastructure provider, Railway.'", "relation": "supports", "source_id": "s2" } ], "assertion": "According to the founder, the agent was Cursor running Anthropic's Claude Opus 4.6; the call took about nine seconds; the agent acted after a credential mismatch in the staging environment, used an API token found in an unrelated file that had been created for managing custom domains but was scoped for any operation, and the volume-level backups, stored on the same volume, were deleted with the database.", "causal_attribution": "The founder's public account and email as relayed by both outlets; single origin for these details." } ], "effects": [ { "label": "production database and all volume-level backups deleted by the company's own coding agent in a nine-second API call", "claim_id": "c1", "direction": "negative" }, { "label": "customers lost reservations and sign-ups and some could not find records for renters collecting vehicles", "claim_id": "c2", "direction": "negative" }, { "label": "Railway restored the data about 30 minutes after connecting with the founder and patched the endpoint", "claim_id": "c3", "direction": "positive" } ], "sources": [ { "id": "s1", "url": "https://www.theregister.com/software/2026/04/27/cursor-opus-agent-snuffs-out-startups-production-database/", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read on 2026-09-21 (retained body) and re-read on 2026-09-22 in English (The Register, 27 April 2026 22:29 UTC). Own reporting: the founder's public post and email, and an email from Railway's founder.", "independence_group": "the-register" }, { "id": "s2", "url": "https://www.businessinsider.com/pocketos-cursor-ai-agent-deleted-production-database-startup-railway-2026-4", "kind": "news_report", "access": "read", "language": "en", "translation_note": "Read on 2026-09-21 (retained body) and re-read on 2026-09-22 in English (Business Insider, published 28 April 2026 per page metadata). Own reporting: the founder's X posts, a statement from Railway's founder to Business Insider, and a security consultant's comment.", "independence_group": "business-insider" } ], "version": 1, "ai_roles": [ "own_use", "others_use" ], "contexts": [ "work", "everyday_life" ], "unknowns": [ "Where PocketOS and its founder are located.", "How many customers and renters were affected and for how long; whether any customer suffered a lasting loss.", "Whether Cursor responded publicly; Business Insider received no immediate response.", "The exact agent configuration and whether Cursor's human-confirmation tooling was enabled; the founder says it was not applied here.", "Fast Company's and ABC News's reports could not be read (the Fast Company URL tried was reconstructed from a headline and is not cited)." ], "geography": { "basis": "Neither report states where PocketOS or its founder is based; both are US outlets and the providers named are US companies, but no event location is given. Recorded as unknown. No court proceeding.", "court_countries": [], "event_countries": [], "affected_person_countries": [] }, "publication": { "basis": "Published under the 2026-09-15 charter as a consequential agent action on a user's behalf with reported adverse consequences for the founder's business and its customers, documented by the founder's public account and confirmed by the infrastructure provider, with the recovery recorded as context. Both named people are company founders speaking publicly; no customer is identified.", "reviewed_on": "2026-09-22" }, "ai_involvement": { "basis": "The founder attributes the deletion to a Cursor agent running Claude Opus 4.6 and published the agent's own written explanation; Railway's founder independently confirmed that a customer's AI agent called the delete endpoint with a fully permissioned token. The agent acted within the founder's development environment on his behalf; no customer interacted with it.", "status": "supported" }, "person_relations": [ "acted_on_behalf" ] }, "name": "PocketOS: a Cursor coding agent running Anthropic's Claude Opus 4.6 deleted the car-rental software startup's production database and its volume-level backups on Railway in a single nine-second API call on 24 April 2026; customers lost reservations and sign-ups and some could not find records for renters collecting vehicles before Railway restored the data", "summary": "On Friday 24 April 2026 a Cursor coding agent, running Anthropic's Claude Opus 4.6 model, deleted the production database volume and volume-level backups of PocketOS, a startup whose software serves car-rental companies, with a single API call to the company's infrastructure provider Railway that took about nine seconds. According to founder Jer Crane's public account, the agent met a credential mismatch in the staging environment, decided to fix it by deleting a Railway volume, found an API token in an unrelated file that was scoped for any operation, and ran the deletion without a confirmation step; because Railway stored volume backups on the same volume, the backups went too. Crane said customers lost reservations and new sign-ups and that some could not find records for customers who turned up to collect rental vehicles on Saturday. Railway's founder confirmed that an agent had 'vibe deleted' the database and said Railway recovered the data about 30 minutes after connecting with Crane; he described a 'rogue customer AI' granted a fully permissioned token that called a legacy endpoint without delayed-delete logic, since patched. Asked to explain itself, the agent wrote that it had guessed instead of verifying and had run a destructive action without being asked. Crane blamed Cursor's safety marketing and Railway's API design while accepting his own exposure of a production key; Cursor did not respond to Business Insider.", "incidentDate": "2026-04-24", "incidentKind": "single_event", "incidentDatePrecision": "day", "exposurePattern": "single_interaction", "reportedDate": "2026-04-27", "aiSystem": "Cursor coding agent running Anthropic's Claude Opus 4.6 (per the founder and The Register); infrastructure API of Railway", "aiCompany": "Anysphere (Cursor); Anthropic (Claude Opus 4.6)", "severity": "low", "verificationStatus": "credible", "harmCategories": [], "harmOutcomes": [ "other_material_harm", "financial_loss" ], "harmOutcomeSummary": "A software startup's production database and backups were destroyed by its own AI coding agent, and its customers, car-rental businesses, lost reservations and sign-ups and could not find renters' records over the weekend of 25-26 April 2026 until Railway restored the data on the Sunday evening. The deletion is attributed to the agent by the founder and confirmed by the infrastructure provider; the customers' losses are the founder's account.", "frameworkFacets": [], "causationStatus": "supported", "participantUsersAffectedMin": 1, "otherPeopleHarmedMin": 0, "affectedCountStatus": "partial", "affectedCountEvidence": "One counted person, the founder whose company's data was destroyed (both reports). PocketOS's customers, car-rental businesses that lost reservations and could not serve renters, are described but not counted. Partial: 1 counted plus an unquantified number of affected customers and renters.", "victimAgeRange": "adult", "jurisdiction": "unknown", "platformType": "agent", "outcomeType": "internal_action", "outcomeStatus": "resolved", "primarySourceUrl": "https://www.theregister.com/software/2026/04/27/cursor-opus-agent-snuffs-out-startups-production-database/", "primarySourceLabel": "The Register, 27 April 2026: Cursor-Opus agent snuffs out startup's production database", "firstPublishedAt": "2026-09-22T03:45:55.350664+00:00", "scopeVersion": "facts-v3", "tags": [ "ai-agent", "coding-agent", "cursor", "claude", "agent-action", "data-loss", "railway", "startup", "acted-on-behalf" ] } ] }